FR
IT consulting and SAP security services in Geneva
IT & SAP Security Consulting

Our Consulting Services

Meylan Technologies & Consulting is an IT and SAP consulting firm based in Geneva, Switzerland, serving clients across Western Switzerland (Suisse Romande: Geneva, Lausanne, Neuchâtel, Fribourg), German-speaking Switzerland, and internationally. We deliver consulting services across SAP S/4HANA migration, ERP and SAP security, SAP GRC, IT controls, IT audit, cybersecurity, AI governance, and data analytics.

By integrating deep IT risk and audit proficiency with extensive SAP ecosystem expertise (ECC, S/4HANA, SAP BTP, RISE with SAP, GROW with SAP), we ensure our clients receive effective and reliable support, from strategic scoping through go-live.

At a glance

Partnerships

For large-scale programs (full S/4HANA transformations, group-wide SAP GRC deployments, international audits), we partner with leading global audit, risk and technology consulting firms. This gives you a Swiss-based senior team focused on your security and authorization outcomes, backed by the functional delivery capacity of a large firm when the scope requires it.

SAP Services

See our dedicated SAP Security page for the full specialty scope, SAP GRC, authorizations, Firefighter/EAM and platform cybersecurity across ECC and S/4HANA.

1. SAP S/4HANA Migration

  • S/4HANA readiness assessment: custom code diagnostic, SoD baseline, Fiori readiness, integration landscape review and approach recommendation (Greenfield, Brownfield, Selective Data Transition).
  • S/4HANA authorization redesign: business role design, SoD-clean role catalogue, Firefighter process, integration with identity providers.
  • Cutover and post-go-live support: authorization testing, emergency access readiness, post-migration access review.
  • SAP Cloud, RISE and GROW with SAP: advisory on edition selection (Private Edition, Public Edition), operating model and internal control implications.

Read our guide: SAP S/4HANA Migration in Switzerland.

2. SAP Security & Authorizations

  • Authorization concept design: roles built around real job functions, SoD-clean by construction, documented so auditors and your support team can follow them. For S/4HANA this includes business roles, Fiori catalogs and spaces, and the new authorization objects.
  • Role redesign: greenfield or brownfield, we redesign existing roles to remove structural SoD conflicts and excessive access, with a migration plan your users will not notice.
  • SAP security configuration review: system parameters, privileged users (SAP_ALL, SAP_NEW, Basis access), user management and the SAP security baseline, with prioritized remediation.
  • RFC and interface security: hardening of RFC connections and gateway access, including UCON to limit which function modules can be called remotely.
  • Identity integration: connecting SAP user provisioning and access requests to your IAM (ServiceNow, Omada, Microsoft Entra ID, SuccessFactors) so that joiners, movers and leavers are handled consistently.

3. SAP GRC & SoD Analysis

  • SoD Ruleset Benchmarking and Improvement: Analyze and optimize rulesets within SAP Governance, Risk, and Compliance (GRC), ensuring alignment with industry standards and regulatory requirements (SOX, ISAE 3402, Swiss FINMA).
  • SoD Conflicts Remediation & Mitigation: Use our data analytics tools, including MTC Skopos, to identify and remediate Segregation of Duties (SoD) conflicts on SAP, S/4HANA and non-SAP systems, reducing risk and ensuring compliance.
  • Firefighter Process Design and Implementation: Design and implement emergency access management processes, including technical configuration and rollout across complex organizational structures. See our guide on SAP Firefighter Role Design.
  • Alternative to SAP GRC: For organizations that do not have the scale to justify a full SAP GRC deployment, we offer lighter approaches based on MTC Skopos. See SAP GRC vs MTC Skopos.

SAP BTP & Cloud Security

More and more of the SAP landscape runs on SAP Business Technology Platform: Fiori launchpads in Build Work Zone, custom UI5 and CAP applications, workflows, Integration Suite flows, and the BTP services that come with RISE with SAP. Each of these is a path into S/4HANA, and each has its own accounts, authorizations, identity provider and logs.

Classic SAP security reviews stop at the S/4HANA back end, and cloud security posture tools usually cannot connect to BTP. We cover it as part of our SAP security practice, with the same discipline we apply to roles and segregation of duties in the ERP.

4. SAP BTP Security Services

BTP security review

A read-only, evidence-based review of an existing BTP landscape. It answers two questions: how a user authenticates and which identity actually reaches each system behind the application, and what the application really calls and with which credentials. We review the trust configuration and federation chain, role collections and administrators, destinations and outbound calls, Cloud Connector exposure, application data exposure, platform settings, development practice and endpoint exposure. The review sends no attack traffic.

Full scope and deliverables of the SAP BTP Security Review

Security design for BTP projects and RISE programs

Most BTP security issues are created during the build phase, when the priority is to make integrations work. We join the program early to set the rules before they become expensive to change:

  • Account model: global account, directory and subaccount structure, separation of development, test and production, and a small, named set of administrators.
  • Role collections: designed around job functions, mapped to identity provider groups rather than assigned user by user, with attribute-based restrictions where the application supports them.
  • Connectivity: Cloud Connector exposure limited to the back-end paths and RFC modules the applications need, principal propagation instead of shared technical users, and rules for destinations and service keys.
  • External access to Fiori: BTP-based designs as an alternative to publishing a Fiori front-end server on the internet.

Identity and access with SAP Cloud Identity Services

  • Identity Authentication (IAS) as a proxy to your corporate identity provider (Microsoft Entra ID or other), with single sign-on, MFA and conditional authentication.
  • Identity Provisioning (IPS) to keep users and groups in sync between your directory, BTP and other SAP cloud applications.
  • Removal of non-federated logon paths, such as the default SAP ID service left enabled for business users.

Ongoing control and audit readiness

  • BTP in your access governance: role collections included in SoD analysis and periodic access reviews, alongside the ERP.
  • Administrator recertification: global account, subaccount, destination and Cloud Connector administrators, including external and dormant accounts.
  • Audit logs: retrieval of BTP audit logs before their retention expires and forwarding to your SIEM.
  • ITGC evidence: changes to destinations and the Cloud Connector brought under change management, with the evidence your auditors will ask for.

Common findings

Patterns we see in BTP subaccounts, stated generally:

  • The default SAP identity provider is still enabled next to the corporate identity provider, offering a path around federation and MFA.
  • The back end is reached with a technical user and a stored password, so S/4HANA authorizations apply to the technical user and not to the person using the application.
  • Applications load complete datasets into the browser and filter them there.
  • Administrative role collections are assigned directly to many users, often external and often dormant.
  • Personal credentials of current or former consultants remain stored in destinations.
  • BTP audit logs are not retrieved.

Read our guide: SAP BTP Security: Role Collections, IAS & Cloud Connector.

IT Controls & Audit

5. IT Controls Design & Implementation

  • Risk-Based IT Controls: Design and implement IT controls linked to financial reporting objectives and operational priorities. We build control frameworks that match your company's size, maturity, and regulatory context.
  • Control Automation: Streamline and automate controls to reduce costs, manual effort, and error rates. We leverage existing tools and technologies to make compliance sustainable.
  • Security Program Implementation: Deploy practical, enterprise-ready security initiatives covering access management, change management, and IT operations.
  • Vendor Risk Management: Establish and modernize vendor risk management processes, including third-party security assessments and security questionnaire support.
  • Compliance Framework Adaptation: Tailor compliance frameworks (SOX, ISAE 3402, Swiss FINMA) to your organization's growth phase and business model, avoiding over-engineering while meeting regulatory expectations.

6. IT Audit & SOC Readiness

  • IT Audit and Internal Control Assessments: Conduct IT audits and internal control evaluations aligned with business objectives. We identify weaknesses and provide actionable remediation plans.
  • SOC 1 & SOC 2 Readiness: Prepare your organization for SOC examinations through gap analysis against SOC criteria, scope definition, and control documentation. We help you understand what auditors expect and close gaps before the examination.
  • Audit Remediation & Mitigation: Address audit findings and recommendations, develop remediation plans, and implement corrective actions for identified weaknesses in systems and processes.
  • Control Design and Testing: Design and implement first-line and second-line of defense controls, then test their operating effectiveness. We deliver clear, audit-ready documentation.
  • Information Security Posture Assessment: Evaluate your current security posture, identify risks, and provide prioritized recommendations for improvement.

Fraud Detection, Monitoring & AI Governance

7. Fraud detection and continuous monitoring

  • Fraud and anomaly detection: Use data analytics and AI to surface fraud patterns, abnormal transactions and suspicious access in your SAP data (change documents, access logs, postings) and non-SAP systems.
  • Continuous access and control monitoring: Run regular analytics over access, SoD conflicts and key controls to move from point-in-time review to continuous monitoring.
  • Compliance reporting: Build Power BI dashboards that give management and auditors visibility into access risk and control status.

8. AI governance

  • AI governance frameworks: Design practical governance (clear ownership, decision rights, guardrails) so you can adopt AI without creating new access or compliance risk.
  • AI risk assessment and controls: Evaluate the regulatory and operational risks of AI adoption, and put policies and controls in place before they become audit findings.

Cybersecurity Beyond the ERP

Your ERP does not sit alone. The same people, identities and suppliers that reach SAP also reach your directory, your cloud tenant and your other business applications. Building on our CISSP and CISA certifications, we extend the discipline we apply inside the ERP to the security around it, for organizations that need senior guidance without a full in-house security team.

We do not operate a SOC or provide 24/7 incident response. For certified penetration testing or red-teaming, we help you scope the work and coordinate with the right specialists.

9. Identity & Access Beyond the ERP

  • Identity & access management across your applications: Extend least-privilege principles and joiner-mover-leaver processes from the ERP to your directory (Active Directory / Microsoft Entra ID) and other business applications, consistent with your ERP role model.
  • User access reviews: Design and run periodic access recertifications across the ERP, the directory and key applications, with evidence your auditors can rely on.
  • Privileged & emergency access: Apply the same rigour as SAP Firefighter to administrator, service and emergency accounts outside SAP.
  • MFA & SSO adoption: Plan strong authentication and single sign-on, including for the ERP and its cloud services.

10. Security Governance, Risk & Compliance

  • Cyber risk assessment & gap analysis: Assess your security posture against ISO/IEC 27001 or the NIST Cybersecurity Framework, starting from your business-critical systems, and deliver a remediation plan prioritized by business impact.
  • ISO/IEC 27001 readiness: Scoping, control gap analysis, Statement of Applicability (SoA) and documentation support through to the certification audit.
  • Data protection & privacy: Align security controls with the Swiss nFADP and GDPR, including data mapping and technical & organizational measures, where personal data sits in your ERP and beyond.
  • Third-party & cloud provider risk: Assess suppliers and hosting partners, including the providers running your ERP (RISE with SAP, managed services), and set up a repeatable vendor risk process.

11. Security Architecture & Resilience

  • Security architecture review: Review defence-in-depth across network, endpoints, identity and cloud (Microsoft Azure / Microsoft 365), with prioritized hardening recommendations.
  • Business continuity & incident response readiness: Build BCP/DRP plans, define incident response procedures and run tabletop exercises so your team is ready before an incident.
  • Security awareness & training: Deliver role-based awareness programmes and phishing simulations to strengthen your human layer of defence.

Let's discuss your needs

Every organization faces different risks. As an ERP security consulting firm based in Geneva, specialised in SAP, we serve clients across Western Switzerland (Geneva, Lausanne, Neuchâtel, Fribourg, Yverdon, Sion), German-speaking Switzerland, neighboring France, and internationally. Whether you are planning an S/4HANA migration, an SAP GRC project, an SoD assessment or an IT audit, get in touch for an initial, no-commitment discussion.

View our fixed-price packages Contact us